Network security management is becoming a more difficult problem as networks grow in size and become a more integral part of organizational operations. Attacks on networks are growing both due to the intellectual challenge such attacks represent for hackers and due to the increasing payoff for the serious attacker. Furthermore, the attacks are growing beyond the current capability of security management tools to identify and quickly respond to those attacks. As various attack methods are tried and ultimately repulsed, the attackers will attempt new approaches with more subtle attack features. Thus, maintaining network security is an on-going, ever changing, and increasingly complex problem.
Computer network attacks can take many forms and any one attack may include many security events of different types. Security events are anomalous network conditions each of which may cause an anti-security effect to a computer network. Security events include stealing confidential or private information; producing network damage through mechanisms such as viruses, worms, or Trojan horses; overwhelming the network's capability in order to cause denial of service, and so forth.
Security systems often employ security risk-assessment tools, i.e. “scanners,” to simulate an attack against computer systems via a remote connection. Such scanners can probe for network weaknesses by simulating certain types of security events that make up an attack. Such tools can also test user passwords for suitability and security. Moreover, scanners can search for known types of security events in the form of malicious programs such as viruses, worms, and Trojan horses. Further, Page:2
scanners are used for content filtering to enforce an organization's operational policies [i.e. detecting harassing or pornographic content, junk e-mails, misinformation (virus hoaxes), etc.].
In most security systems, data often gets scanned multiple times as it is transmitted through various network elements. For data entering from external networks, there is usually some security scanning that first takes place at a network gateway. Then, the data is scanned again when it is saved to a server after which it is scanned once again by an end user workstation upon retrieval. This redundant scanning results in unnecessary, duplication of computing workload resources. Organizations must purchase equipment that can handle all such additional information processing in the form of more memory and additional processing capacity. There is thus a need for reducing the redundancy of scanning in security system scanning, and avoiding the need for additional resources.
Security systems often use gateway scanning to analyze data entering a network from other uncontrolled networks to detect possible attacks. Of course, this requires time and resources at the gateway. As such, gateway scanning often involves a balance between providing timely access to the data stream by an end user, and providing a thorough scan of the incoming data. So long as there is not much data passing through the gateway, comprehensive scanning can be accomplished without interrupting timely user access to the data. However, if the gateway is extremely busy checking for many different potential threats, the data access may be unacceptably constricted. There is thus a need for optimally balancing timely access to the data stream by an end user, and providing a thorough scan of the incoming data in a gateway environment.
Current security systems employ an “all or nothing” approach to scanning. When triggered either by an access or scheduled request, a specified scan must be executed completely (100%) irregardless of current computing resource availability. Some e-mail server scanning programs feature “trusted scanning.” Once an item has been scanned by one server, it may be flagged so subsequent e-mail servers can avoid re-scanning the item. Unfortunately, such e-mail server scanning programs require complete scans if one is required at all. There is thus a need for improving load balancing by exploiting partial scans as opposed to the complete scans of the prior art.